Description
SQL injection vulnerability in the Schema API in Drupal 6.x before 6.3 allows remote attackers to execute arbitrary SQL commands via vectors related to "an inappropriate placeholder for 'numeric' fields."
References
- 30168 vdb-entry
- http://drupal.org/node/280571
- drupal-schemaapi-sql-injection(43705) vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=454849
- FEDORA-2008-6916 vendor-advisory
- 31079 third-party-advisory
- FEDORA-2008-6415 vendor-advisory
- [oss-security] 20080710 CVE request: multiple drupal issues in < 6.3,5.8 mailing-list
- FEDORA-2008-6411 vendor-advisory